[PATCH] drm/exynos: limit G2D GEM map count
From: Pengpeng Hou <hidden>
Date: 2026-07-22 04:08:55
Also in:
linux-samsung-soc, lkml
Subsystem:
drm drivers, drm drivers for exynos, the rest · Maintainers:
David Airlie, Simona Vetter, Inki Dae, Seung-Woo Kim, Kyungmin Park, Linus Torvalds
exynos_g2d_set_cmdlist_ioctl() accepts cmd_buf_nr from userspace and
later uses it to index the fixed reg_types array while validating GEM
mapping commands. The existing G2D command-page limit is much larger
than that array.
Keep ordinary commands bounded by the command-page capacity, but bound
GEM mapping commands by MAX_REG_TYPE_NR before storing or validating
them. Perform the checks before taking a command-list node so an invalid
request cannot consume an entry from the free list.
Fixes: d7f1642c90ab ("drm/exynos: add G2D driver")
Signed-off-by: Pengpeng Hou <redacted>
---
drivers/gpu/drm/exynos/exynos_drm_g2d.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index e92a4d872c41..2dfea16f32cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c@@ -1151,21 +1151,17 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data, int size; int ret; - node = g2d_get_cmdlist(g2d); - if (!node) - return -ENOMEM; - - /* - * To avoid an integer overflow for the later size computations, we - * enforce a maximum number of submitted commands here. This limit is - * sufficient for all conceivable usage cases of the G2D. - */ + /* GEM mapping commands also populate fixed-size buf_info arrays. */ if (req->cmd_nr > G2D_CMDLIST_DATA_NUM || - req->cmd_buf_nr > G2D_CMDLIST_DATA_NUM) { + req->cmd_buf_nr > MAX_REG_TYPE_NR) { dev_err(g2d->dev, "number of submitted G2D commands exceeds limit\n"); return -EINVAL; } + node = g2d_get_cmdlist(g2d); + if (!node) + return -ENOMEM; + node->event = NULL; if (req->event_type != G2D_EVENT_NOT) {
--
2.50.1 (Apple Git-155)